Secunia

Two vulnerabilities have been reported in LANSuite 2003 allowing malicious people to see sensitive information.

1) Certain files with information about current users are available to malicious people from the "/mail/" folder. The file "tempdirs.lst" contains information about temporary folder names used by authenticated users. The temporary folder contains two files ("MSGlist.mid" and "MSGlist.mil"), which contains message IDs, username, and mailbox number.

Daily log files with information about username, user IP, and login times are also available from the "/mail/" folder. These files are named "S[YYMMDD].LOG".

2) Authenticated users may gain access to arbitrary files by exploiting a directory traversal vulnerability. The problem is that "M602cl3w.exe" doesn't verify the "FN" parameter properly when the function "GetFile" is used. This allows malicious users to traverse directories using "../".

The vulnerabilities have been reported in 602Pro LANSuite 2003 build 2003.0.3.0828. However, other versions may also be affected.

Solution
Install update:
Further details available in Customer Area

Provided and/or discovered by
Phuong Nguyen

Deep Links
Links available in Customer Area